"""
User Secrets Vault

Stores user-owned API keys for live exchange execution. Secured with the user's
password — Dexorder cannot read these secrets. This is entirely separate from
secrets.yaml, which holds Dexorder infrastructure credentials (Iceberg, MinIO, etc.).

Currently a stub — raises NotImplementedError on all calls. Will be backed by
a user-local encrypted store in a future iteration.
"""


class SecretsVault:
    """
    Interface for the user secrets vault.

    The vault is secured with the user's own password; the Dexorder platform
    cannot decrypt or access its contents. This distinguishes it from the
    system-level secrets.yaml, which stores infrastructure credentials managed
    by Dexorder operators.

    Typical keys stored here:
        "BINANCE_API_KEY", "BINANCE_API_SECRET"
        "COINBASE_API_KEY", "COINBASE_API_SECRET"
        etc.
    """

    def get_secret(self, key: str) -> str:
        """
        Retrieve a user secret by key.

        Args:
            key: Identifier for the secret, e.g. "BINANCE_API_KEY"

        Returns:
            The secret value as a string.

        Raises:
            NotImplementedError: Always — vault not yet implemented.
        """
        raise NotImplementedError(
            "User secrets vault is not yet implemented. "
            "Live execution API key management is a future feature."
        )

    def set_secret(self, key: str, value: str) -> None:
        """
        Store a secret in the vault.

        Args:
            key: Identifier for the secret
            value: Secret value to store (stored encrypted with user's password)

        Raises:
            NotImplementedError: Always — vault not yet implemented.
        """
        raise NotImplementedError(
            "User secrets vault is not yet implemented. "
            "Live execution API key management is a future feature."
        )

    def delete_secret(self, key: str) -> None:
        """
        Remove a secret from the vault.

        Raises:
            NotImplementedError: Always — vault not yet implemented.
        """
        raise NotImplementedError(
            "User secrets vault is not yet implemented."
        )
